MorpheusAI

Summary

When editing pool's parameters there is no validity check for the payoutStart parameter.

Vulnerability Details

editPool function allows the owner to change all of the created pool paramaters. When creating a pool, using createPool function, these parameters are set and there is valididty check for two of them - decreaseInterval to be greater than 0 and payoutStart to be more than the current block.timestamp.

When editing these parameters, there is only a check for decreaseInterval. However, I believe it is necessary to ensure that payoutStart is in the valid range. If the previous value of payoutStart' has passed and the payout has already started, it should no longer be changed. Or another invalid value would be to set payoutStart` earlier than the pool creation.

Impact

payoutStart can be set to an earlier value than the pool creation.

Tools Used

Manual Review

Recommendations

Check that the new payoutStart has a valid value.